CVE-2026-114820

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, and 27.0.1.0.2 Oracle GraalVM for JDK versions 17.0.21.0.2 and 21.0.13.0.2 Oracle GraalVM Enterprise Edition version 21.3.20.0.2

Description An issue exists in the JSSE component that allows an unauthenticated remote attacker to compromise the system via multiple network protocols. This can lead to unauthorized access, creation, deletion, or modification of critical data. The flaw can be exploited through APIs, such as web services providing data to those APIs, and also affects Java deployments running sandboxed Java Web Start applications or sandboxed Java applets that load untrusted code from the internet.

Recommendations For Oracle Java SE versions 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, and 27.0.1.0.2, apply the Oracle CPU patches to update the trust-store and remove root CA certificates tied to eMudhra. For Oracle GraalVM for JDK versions 17.0.21.0.2 and 21.0.13.0.2, apply the Oracle CPU patches to update the trust-store and remove root CA certificates tied to eMudhra. For Oracle GraalVM Enterprise Edition version 21.3.20.0.2, apply the Oracle CPU patches to update the trust-store and remove root CA certificates tied to eMudhra.